[v6.1] inconsistent lock state in lock_sock_nested
0 views
Skip to first unread message
syzbot
Aug 3, 2026, 2:17:40 PM (2 days ago) Aug 3
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=115cccc6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b929c6f31f99858c2633
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b929c6...@syzkaller.appspotmail.com
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/0/15 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000d8ce8130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
ffff0000d8ce8130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_bind+0x1b4/0x3d4 net/x25/af_x25.c:698
__sys_bind+0x1f8/0x2a4 net/socket.c:1811
__do_sys_bind net/socket.c:1822 [inline]
__se_sys_bind net/socket.c:1820 [inline]
__arm64_sys_bind+0x7c/0x94 net/socket.c:1820
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 50111604
hardirqs last enabled at (50111604): [<ffff8000081ad57c>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (50111603): [<ffff8000081ad4fc>] __local_bh_enable_ip+0x178/0x37c kernel/softirq.c:403
softirqs last enabled at (50108946): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (50108946): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (50108949): [<ffff8000081b136c>] run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
1 lock held by ksoftirqd/0/15:
#0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349
stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_usage_bug+0x4c0/0x6dc kernel/locking/lockdep.c:3962
valid_state kernel/locking/lockdep.c:3974 [inline]
mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1
mark_lock+0x224/0x320 kernel/locking/lockdep.c:4633
mark_usage kernel/locking/lockdep.c:-1 [inline]
__lock_acquire+0xa88/0x6634 kernel/locking/lockdep.c:5017
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
BUG: sleeping function called from invalid context at net/core/sock.c:3507
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15, name: ksoftirqd/0
preempt_count: 100, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff8000081ad988>] softirq_handle_begin kernel/softirq.c:434 [inline]
[<ffff8000081ad988>] handle_softirqs+0xe8/0xc90 kernel/softirq.c:572
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x354/0x4e0 kernel/sched/core.c:9970
__might_sleep+0x94/0x110 kernel/sched/core.c:9899
lock_sock_nested+0x80/0x130 net/core/sock.c:3507
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=115cccc6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b929c6f31f99858c2633
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b929c6...@syzkaller.appspotmail.com
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/0/15 [HC0[0]:SC1[1]:HE1:SE0] takes:
ffff0000d8ce8130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
ffff0000d8ce8130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_bind+0x1b4/0x3d4 net/x25/af_x25.c:698
__sys_bind+0x1f8/0x2a4 net/socket.c:1811
__do_sys_bind net/socket.c:1822 [inline]
__se_sys_bind net/socket.c:1820 [inline]
__arm64_sys_bind+0x7c/0x94 net/socket.c:1820
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 50111604
hardirqs last enabled at (50111604): [<ffff8000081ad57c>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (50111603): [<ffff8000081ad4fc>] __local_bh_enable_ip+0x178/0x37c kernel/softirq.c:403
softirqs last enabled at (50108946): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (50108946): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (50108949): [<ffff8000081b136c>] run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
1 lock held by ksoftirqd/0/15:
#0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349
stack backtrace:
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
print_usage_bug+0x4c0/0x6dc kernel/locking/lockdep.c:3962
valid_state kernel/locking/lockdep.c:3974 [inline]
mark_lock_irq+0x858/0xab8 kernel/locking/lockdep.c:-1
mark_lock+0x224/0x320 kernel/locking/lockdep.c:4633
mark_usage kernel/locking/lockdep.c:-1 [inline]
__lock_acquire+0xa88/0x6634 kernel/locking/lockdep.c:5017
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
BUG: sleeping function called from invalid context at net/core/sock.c:3507
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 15, name: ksoftirqd/0
preempt_count: 100, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff8000081ad988>] softirq_handle_begin kernel/softirq.c:434 [inline]
[<ffff8000081ad988>] handle_softirqs+0xe8/0xc90 kernel/softirq.c:572
CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x354/0x4e0 kernel/sched/core.c:9970
__might_sleep+0x94/0x110 kernel/sched/core.c:9899
lock_sock_nested+0x80/0x130 net/core/sock.c:3507
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
run_ksoftirqd+0x7c/0x2ac kernel/softirq.c:968
smpboot_thread_fn+0x4e8/0x960 kernel/smpboot.c:164
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
11:22 AM (6 hours ago) 11:22 AM
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1671ecc6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14480132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b929c6...@syzkaller.appspotmail.com
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
hardirqs last enabled at (771096): [<ffff8000081ad57c>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (771095): [<ffff8000081ad4fc>] __local_bh_enable_ip+0x178/0x37c kernel/softirq.c:403
softirqs last enabled at (770762): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (770762): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (770823): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
1 lock held by swapper/0/0:
__do_softirq+0x14/0x20 kernel/softirq.c:630
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x368/0x600 kernel/sched/idle.c:323
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
rest_init+0x2d4/0x2f0 init/main.c:745
start_kernel+0x0/0x534 init/main.c:904
start_kernel+0x488/0x534 init/main.c:1151
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
preempt_count: 101, expected: 0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x368/0x600 kernel/sched/idle.c:323
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
rest_init+0x2d4/0x2f0 init/main.c:745
start_kernel+0x0/0x534 init/main.c:904
start_kernel+0x488/0x534 init/main.c:1151
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=b929c6f31f99858c2633
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13140e49580000
dashboard link: https://syzkaller.appspot.com/bug?extid=b929c6f31f99858c2633
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14480132580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b929c6...@syzkaller.appspotmail.com
================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
ffff0000ccb80130 (sk_lock-AF_X25){+.?.}-{0:0}, at: x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
{SOFTIRQ-ON-W} state was registered at:
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_bind+0x1b4/0x3d4 net/x25/af_x25.c:698
__sys_bind+0x1f8/0x2a4 net/socket.c:1811
__do_sys_bind net/socket.c:1822 [inline]
__se_sys_bind net/socket.c:1820 [inline]
__arm64_sys_bind+0x7c/0x94 net/socket.c:1820
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 771096
lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
lock_sock_nested+0x70/0x130 net/core/sock.c:3505
lock_sock include/net/sock.h:1805 [inline]
x25_bind+0x1b4/0x3d4 net/x25/af_x25.c:698
__sys_bind+0x1f8/0x2a4 net/socket.c:1811
__do_sys_bind net/socket.c:1822 [inline]
__se_sys_bind net/socket.c:1820 [inline]
__arm64_sys_bind+0x7c/0x94 net/socket.c:1820
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
hardirqs last enabled at (771096): [<ffff8000081ad57c>] __local_bh_enable_ip+0x1f8/0x37c kernel/softirq.c:426
hardirqs last disabled at (771095): [<ffff8000081ad4fc>] __local_bh_enable_ip+0x178/0x37c kernel/softirq.c:403
softirqs last enabled at (770762): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (770762): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (770823): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(sk_lock-AF_X25);
<Interrupt>
lock(sk_lock-AF_X25);
*** DEADLOCK ***
#0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x18/0x54 include/linux/rcupdate.h:349
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
stack backtrace:
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x368/0x600 kernel/sched/idle.c:323
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
rest_init+0x2d4/0x2f0 init/main.c:745
start_kernel+0x0/0x534 init/main.c:904
start_kernel+0x488/0x534 init/main.c:1151
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
BUG: sleeping function called from invalid context at net/core/sock.c:3507
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/0
preempt_count: 101, expected: 0
RCU nest depth: 1, expected: 0
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff800011c64be4>] schedule_preempt_disabled+0x20/0x2c kernel/sched/core.c:6699
INFO: lockdep is turned off.
Preemption disabled at:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x354/0x4e0 kernel/sched/core.c:9970
__might_sleep+0x94/0x110 kernel/sched/core.c:9899
lock_sock_nested+0x80/0x130 net/core/sock.c:3507
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
__do_softirq+0x14/0x20 kernel/softirq.c:630
Call trace:
dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
dump_stack+0x1c/0x5c lib/dump_stack.c:113
__might_resched+0x354/0x4e0 kernel/sched/core.c:9970
__might_sleep+0x94/0x110 kernel/sched/core.c:9899
lock_sock_nested+0x80/0x130 net/core/sock.c:3507
lock_sock include/net/sock.h:1805 [inline]
x25_kill_by_neigh+0x94/0x138 net/x25/af_x25.c:1781
x25_link_terminated+0x5c/0x78 net/x25/x25_link.c:257
x25_lapb_receive_frame+0x140/0xd0c net/x25/x25_dev.c:138
__netif_receive_skb_one_core net/core/dev.c:5619 [inline]
netif_receive_skb_core+0x160/0x244 net/core/dev.c:5644
lapbeth_napi_poll+0x48/0xa0 drivers/net/wan/lapbether.c:99
__napi_poll+0xb8/0x3f4 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x52c/0xb5c net/core/dev.c:6809
handle_softirqs+0x318/0xc90 kernel/softirq.c:596
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
invoke_softirq kernel/softirq.c:477 [inline]
__irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
__el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_enable+0xc/0x18 arch/arm64/include/asm/irqflags.h:35
default_idle_call+0x68/0xd8 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x368/0x600 kernel/sched/idle.c:323
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:422
rest_init+0x2d4/0x2f0 init/main.c:745
start_kernel+0x0/0x534 init/main.c:904
start_kernel+0x488/0x534 init/main.c:1151
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:468
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages